Und hier das CF Log:

[code]
Combofix Logfile:

ComboFix 12-05-14.03 - admin 14.05.2012  19:40:56.1.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.43.1031.18.4095.2442 [GMT 2:00]
ausgeführt von:: c:\users\admin\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Install.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-04-14 bis 2012-05-14  ))))))))))))))))))))))))))))))
.
.
2012-05-14 11:57 . 2012-05-14 11:57	--------	d-----w-	C:\_OTL
2012-05-11 14:39 . 2012-03-03 06:35	1544704	----a-w-	c:\windows\system32\DWrite.dll
2012-05-11 14:39 . 2012-03-03 05:31	1077248	----a-w-	c:\windows\SysWow64\DWrite.dll
2012-05-11 14:39 . 2012-03-31 06:05	5559664	----a-w-	c:\windows\system32\ntoskrnl.exe
2012-05-11 14:39 . 2012-03-31 04:39	3968368	----a-w-	c:\windows\SysWow64\ntkrnlpa.exe
2012-05-11 14:39 . 2012-03-31 04:39	3913072	----a-w-	c:\windows\SysWow64\ntoskrnl.exe
2012-05-11 14:39 . 2012-03-31 03:10	3146240	----a-w-	c:\windows\system32\win32k.sys
2012-05-11 14:38 . 2012-03-17 07:58	75120	----a-w-	c:\windows\system32\drivers\partmgr.sys
2012-05-11 14:38 . 2012-03-30 11:35	1918320	----a-w-	c:\windows\system32\drivers\tcpip.sys
2012-05-11 14:38 . 2012-03-31 05:42	1732096	----a-w-	c:\program files\Windows Journal\NBDoc.DLL
2012-05-11 14:38 . 2012-03-31 05:40	1402880	----a-w-	c:\program files\Windows Journal\JNWDRV.dll
2012-05-11 14:38 . 2012-03-31 05:40	1367552	----a-w-	c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2012-05-11 14:38 . 2012-03-31 05:40	1393664	----a-w-	c:\program files\Windows Journal\JNTFiltr.dll
2012-05-11 14:38 . 2012-03-31 04:29	936960	----a-w-	c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll
2012-05-03 14:13 . 2012-05-03 14:13	--------	d-----w-	c:\programdata\Malwarebytes
2012-05-03 14:13 . 2012-05-03 14:13	--------	d-----w-	c:\program files (x86)\Malwarebytes' Anti-Malware
2012-05-03 14:13 . 2012-04-04 13:56	24904	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-05-03 12:20 . 2012-05-03 12:20	--------	d-----w-	c:\program files (x86)\ESET
2012-05-03 12:03 . 2012-05-14 20:42	--------	d-----w-	c:\users\admin
2012-05-03 10:14 . 2012-05-03 10:15	--------	d-----w-	c:\users\Gast
2012-04-26 16:36 . 2012-04-26 16:36	--------	d-----w-	c:\program files (x86)\Dnote Software
2012-04-25 19:49 . 2012-04-25 19:49	--------	d-----w-	c:\program files (x86)\MyTomTom 3
2012-04-25 18:01 . 2012-04-25 19:49	--------	d-----w-	c:\users\Papa\AppData\Local\TomTom
2012-04-25 18:01 . 2012-04-25 18:01	--------	d-----w-	c:\users\Papa\AppData\Roaming\TomTom
2012-04-25 18:01 . 2012-04-25 19:49	--------	d-----w-	c:\program files (x86)\TomTom International B.V
2012-04-25 18:01 . 2012-04-25 18:01	--------	d-----w-	c:\program files (x86)\TomTom HOME 2
2012-04-22 14:39 . 2012-04-30 17:20	--------	d-----w-	c:\users\Daniel\AppData\Roaming\.minecraft
2012-04-20 20:49 . 2012-04-20 20:49	--------	d-----w-	c:\windows\de
2012-04-20 20:45 . 2012-04-20 20:45	--------	d-----w-	c:\windows\da
2012-04-20 20:45 . 2012-04-20 20:45	--------	d-----w-	c:\windows\el
2012-04-20 20:45 . 2012-04-20 20:45	--------	d-----w-	c:\windows\en
2012-04-20 20:45 . 2012-04-20 20:45	--------	d-----w-	c:\windows\es
2012-04-20 20:45 . 2012-04-20 20:45	--------	d-----w-	c:\windows\fr
2012-04-20 20:44 . 2012-04-20 20:44	--------	d-----w-	c:\windows\hu
2012-04-20 20:44 . 2012-04-20 20:44	--------	d-----w-	c:\windows\it
2012-04-20 20:44 . 2012-04-20 20:44	--------	d-----w-	c:\windows\nl
2012-04-20 20:44 . 2012-04-20 20:44	--------	d-----w-	c:\windows\pl
2012-04-20 20:44 . 2012-04-20 20:44	--------	d-----w-	c:\windows\sl
2012-04-20 20:44 . 2012-04-20 20:44	--------	d-----w-	c:\windows\tr
2012-04-20 20:35 . 2012-03-08 16:40	48488	----a-w-	c:\windows\system32\drivers\fssfltr.sys
2012-04-20 20:32 . 2012-04-20 20:32	15712	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\bb09d7571cd1f3402\MeshBetaRemover.exe
2012-04-20 20:32 . 2012-04-20 20:32	89944	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\ba6a5b251cd1f3401\DSETUP.dll
2012-04-20 20:32 . 2012-04-20 20:32	537432	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\ba6a5b251cd1f3401\DXSETUP.exe
2012-04-20 20:32 . 2012-04-20 20:32	1801048	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\ba6a5b251cd1f3401\dsetup32.dll
2012-04-20 20:31 . 2012-04-20 20:31	--------	d-----w-	c:\program files (x86)\Microsoft
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-09 13:24 . 2011-10-16 09:29	98848	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2012-05-09 13:24 . 2011-10-16 09:29	132832	----a-w-	c:\windows\system32\drivers\avipbb.sys
2012-05-05 14:15 . 2012-04-13 14:30	419488	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2012-05-05 14:15 . 2011-07-02 17:27	70304	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-05-05 14:15 . 2012-04-13 15:15	8744608	----a-w-	c:\windows\SysWow64\FlashPlayerInstaller.exe
2012-04-05 14:57 . 2012-03-29 15:01	88	----a-w-	c:\users\Public\sdelevURL.tmp
2012-03-08 16:50 . 2012-03-08 16:50	49016	----a-w-	c:\windows\SysWow64\sirenacm.dll
2012-03-08 16:37 . 2012-03-08 16:37	302448	----a-w-	c:\windows\WLXPGSS.SCR
2012-03-01 06:46 . 2012-04-11 14:42	23408	----a-w-	c:\windows\system32\drivers\fs_rec.sys
2012-03-01 06:38 . 2012-04-11 14:42	220672	----a-w-	c:\windows\system32\wintrust.dll
2012-03-01 06:33 . 2012-04-11 14:42	81408	----a-w-	c:\windows\system32\imagehlp.dll
2012-03-01 06:28 . 2012-04-11 14:42	5120	----a-w-	c:\windows\system32\wmi.dll
2012-03-01 05:37 . 2012-04-11 14:42	172544	----a-w-	c:\windows\SysWow64\wintrust.dll
2012-03-01 05:33 . 2012-04-11 14:42	159232	----a-w-	c:\windows\SysWow64\imagehlp.dll
2012-03-01 05:29 . 2012-04-11 14:42	5120	----a-w-	c:\windows\SysWow64\wmi.dll
2012-02-28 06:56 . 2012-04-11 14:45	2311168	----a-w-	c:\windows\system32\jscript9.dll
2012-02-28 06:49 . 2012-04-11 14:44	1390080	----a-w-	c:\windows\system32\wininet.dll
2012-02-28 06:48 . 2012-04-11 14:44	1493504	----a-w-	c:\windows\system32\inetcpl.cpl
2012-02-28 06:42 . 2012-04-11 14:45	2382848	----a-w-	c:\windows\system32\mshtml.tlb
2012-02-28 01:18 . 2012-04-11 14:45	1799168	----a-w-	c:\windows\SysWow64\jscript9.dll
2012-02-28 01:11 . 2012-04-11 14:44	1427456	----a-w-	c:\windows\SysWow64\inetcpl.cpl
2012-02-28 01:11 . 2012-04-11 14:44	1127424	----a-w-	c:\windows\SysWow64\wininet.dll
2012-02-28 01:03 . 2012-04-11 14:45	2382848	----a-w-	c:\windows\SysWow64\mshtml.tlb
2012-02-17 06:38 . 2012-03-14 16:39	1031680	----a-w-	c:\windows\system32\rdpcore.dll
2012-02-17 05:34 . 2012-03-14 16:39	826880	----a-w-	c:\windows\SysWow64\rdpcore.dll
2012-02-17 04:58 . 2012-03-14 16:39	210944	----a-w-	c:\windows\system32\drivers\rdpwd.sys
2012-02-17 04:57 . 2012-03-14 16:39	23552	----a-w-	c:\windows\system32\drivers\tdtcp.sys
2012-02-15 09:01 . 2012-02-15 09:01	52736	----a-w-	c:\windows\system32\drivers\usbaapl64.sys
2012-02-15 09:01 . 2012-02-15 09:01	4547944	----a-w-	c:\windows\system32\usbaaplrc.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]
2011-08-24 17:21	1299248	----a-r-	c:\program files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2011-08-24 1299248]
.
[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-07-01 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-12-09 336384]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-12-20 113288]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"CLMLServer"="c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [2009-11-02 103720]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-05-09 348624]
"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-09-27 59240]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]
"SweetIM"="c:\program files (x86)\SweetIM\Messenger\SweetIM.exe" [2011-08-01 114992]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]
"RIMBBLaunchAgent.exe"="c:\program files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2011-09-01 90448]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-03-27 421736]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ   	kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-01 136176]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-05 257696]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-01 136176]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys [x]
R3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\DRIVERS\ss_bbus.sys [x]
R3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\DRIVERS\ss_bmdfl.sys [x]
R3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\DRIVERS\ss_bmdm.sys [x]
R3 TFsExDisk;TFsExDisk;c:\windows\System32\Drivers\TFsExDisk.sys [2010-06-14 16448]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S0 amd_sata;amd_sata;c:\windows\system32\drivers\amd_sata.sys [x]
S0 amd_xata;amd_xata;c:\windows\system32\drivers\amd_xata.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2010-12-09 354304]
S2 AMD Reservation Manager;AMD Reservation Manager;c:\program files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [2010-06-17 194496]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-05-09 86224]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe [2012-01-23 92592]
S3 amdiox64;AMD IO Driver;c:\windows\system32\drivers\amdiox64.sys [x]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-05-14 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-13 14:15]
.
2012-05-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-01 08:07]
.
2012-05-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-01 08:07]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-01-13 11774568]
"fssui"="c:\program files (x86)\Windows Live\Family Safety\fsui.exe" [2012-03-08 884584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.at/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Search the Web - c:\program files (x86)\SweetIM\Toolbars\Internet Explorer\resources\menuext.html
IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/5221-29898-17534-1/4
TCP: DhcpNameServer = 195.3.96.67 195.3.96.68
FF - ProfilePath - 
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-NPSStartup - (no file)
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Windows Live\Family Safety\fsssvc.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-05-14  23:04:34 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-05-14 21:04
.
Vor Suchlauf: 6 Verzeichnis(se), 1.391.855.976.448 Bytes frei
Nach Suchlauf: 12 Verzeichnis(se), 1.397.041.537.024 Bytes frei
.
- - End Of File - - 01EC6B5F78E62B226CDD898120963B02
         

--- --- ---

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehalalrm!

• Starte die aswMBR.exe Vista und Win7 User aswMBR per Rechtsklick "als Administrator ausführen"
• Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
• Klicke auf Scan.
• Warte bitte bis Scan finished successfully im DOS Fenster steht.
• Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr", dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

Und das nächste Log:

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-05-15 19:15:02
-----------------------------
19:15:02.672    OS Version: Windows x64 6.1.7601 Service Pack 1
19:15:02.672    Number of processors: 4 586 0x503
19:15:02.672    ComputerName: STAND-PC  UserName: admin
19:15:05.214    Initialize success
19:16:41.966    AVAST engine defs: 12051500
19:16:47.613    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000005b
19:16:47.613    Disk 0 Vendor: ST315005 CC34 Size: 1430799MB BusType: 11
19:16:47.629    Disk 0 MBR read successfully
19:16:47.629    Disk 0 MBR scan
19:16:47.645    Disk 0 unknown MBR code
19:16:47.660    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048
19:16:47.660    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS      1398953 MB offset 206848
19:16:47.707    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS        30720 MB offset 2865262592
19:16:47.738    Disk 0 Partition 4 00     12  Compaq diag NTFS         1024 MB offset 2928177152
19:16:47.785    Disk 0 scanning C:\Windows\system32\drivers
19:17:00.015    Service scanning
19:17:21.387    Modules scanning
19:17:21.450    Disk 0 trace - called modules:
19:17:21.465    ntoskrnl.exe CLASSPNP.SYS disk.sys amd_xata.sys storport.sys hal.dll amd_sata.sys 
19:17:21.465    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004974790]
19:17:21.481    3 CLASSPNP.SYS[fffff880019c943f] -> nt!IofCallDriver -> [0xfffffa80039f7040]
19:17:21.481    5 amd_xata.sys[fffff880010cc7a8] -> nt!IofCallDriver -> \Device\0000005b[0xfffffa800489e9c0]
19:17:23.587    AVAST engine scan C:\Windows
19:17:34.055    AVAST engine scan C:\Windows\system32
19:21:17.119    AVAST engine scan C:\Windows\system32\drivers
19:21:31.659    AVAST engine scan C:\Users\admin
19:22:01.626    AVAST engine scan C:\ProgramData
19:23:05.446    Scan finished successfully
19:39:00.604    Disk 0 MBR has been saved successfully to "C:\Users\admin\Desktop\MBR.dat"
19:39:00.620    The log file has been saved successfully to "C:\Users\admin\Desktop\aswMBR.txt"
         

Wir sollten den MBR fixen, sichere für den Fall der Fälle ALLE wichtigen Daten, auch wenn meistens alles glatt geht.

Hinweis: Mach bitte NICHT den MBR-Fix, wenn du noch andere Betriebssysteme wie zB Ubuntu installiert hast, ein MBR-Fix mit Windows-Tools macht ein parallel installiertes (Dualboot) Linux unbootbar.
Mach den Fix auch dann nicht, wenn du zB mit TrueCrypt oder anderen Verschlüsselungsprogrammen eine Vollverschlüsselung der Windowspartition bzw. gesamten Festplatte hast

Starte nach der Datensicherung aswmbr erneut und klick auf den Button FIXMBR.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehalalrm!

Anschließend Windows neu starten und ein neues Log mit aswMBR machen.

MBR Fix erledigt - hier das Log:

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-05-15 19:15:02
-----------------------------
19:15:02.672    OS Version: Windows x64 6.1.7601 Service Pack 1
19:15:02.672    Number of processors: 4 586 0x503
19:15:02.672    ComputerName: STAND-PC  UserName: admin
19:15:05.214    Initialize success
19:16:41.966    AVAST engine defs: 12051500
19:16:47.613    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000005b
19:16:47.613    Disk 0 Vendor: ST315005 CC34 Size: 1430799MB BusType: 11
19:16:47.629    Disk 0 MBR read successfully
19:16:47.629    Disk 0 MBR scan
19:16:47.645    Disk 0 unknown MBR code
19:16:47.660    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048
19:16:47.660    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS      1398953 MB offset 206848
19:16:47.707    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS        30720 MB offset 2865262592
19:16:47.738    Disk 0 Partition 4 00     12  Compaq diag NTFS         1024 MB offset 2928177152
19:16:47.785    Disk 0 scanning C:\Windows\system32\drivers
19:17:00.015    Service scanning
19:17:21.387    Modules scanning
19:17:21.450    Disk 0 trace - called modules:
19:17:21.465    ntoskrnl.exe CLASSPNP.SYS disk.sys amd_xata.sys storport.sys hal.dll amd_sata.sys 
19:17:21.465    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004974790]
19:17:21.481    3 CLASSPNP.SYS[fffff880019c943f] -> nt!IofCallDriver -> [0xfffffa80039f7040]
19:17:21.481    5 amd_xata.sys[fffff880010cc7a8] -> nt!IofCallDriver -> \Device\0000005b[0xfffffa800489e9c0]
19:17:23.587    AVAST engine scan C:\Windows
19:17:34.055    AVAST engine scan C:\Windows\system32
19:21:17.119    AVAST engine scan C:\Windows\system32\drivers
19:21:31.659    AVAST engine scan C:\Users\admin
19:22:01.626    AVAST engine scan C:\ProgramData
19:23:05.446    Scan finished successfully
19:39:00.604    Disk 0 MBR has been saved successfully to "C:\Users\admin\Desktop\MBR.dat"
19:39:00.620    The log file has been saved successfully to "C:\Users\admin\Desktop\aswMBR.txt"


aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-05-16 19:05:46
-----------------------------
19:05:46.884    OS Version: Windows x64 6.1.7601 Service Pack 1
19:05:46.884    Number of processors: 4 586 0x503
19:05:46.884    ComputerName: STAND-PC  UserName: admin
19:05:49.520    Initialize success
19:05:54.684    AVAST engine defs: 12051500
19:06:06.976    The log file has been saved successfully to "C:\Users\admin\Desktop\aswMBR.txt"
         

Du solltest auch ein komplett neues Log mit aswMBR machen

OK, nächster Versuch ...

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-05-15 19:15:02
-----------------------------
19:15:02.672    OS Version: Windows x64 6.1.7601 Service Pack 1
19:15:02.672    Number of processors: 4 586 0x503
19:15:02.672    ComputerName: STAND-PC  UserName: admin
19:15:05.214    Initialize success
19:16:41.966    AVAST engine defs: 12051500
19:16:47.613    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000005b
19:16:47.613    Disk 0 Vendor: ST315005 CC34 Size: 1430799MB BusType: 11
19:16:47.629    Disk 0 MBR read successfully
19:16:47.629    Disk 0 MBR scan
19:16:47.645    Disk 0 unknown MBR code
19:16:47.660    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048
19:16:47.660    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS      1398953 MB offset 206848
19:16:47.707    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS        30720 MB offset 2865262592
19:16:47.738    Disk 0 Partition 4 00     12  Compaq diag NTFS         1024 MB offset 2928177152
19:16:47.785    Disk 0 scanning C:\Windows\system32\drivers
19:17:00.015    Service scanning
19:17:21.387    Modules scanning
19:17:21.450    Disk 0 trace - called modules:
19:17:21.465    ntoskrnl.exe CLASSPNP.SYS disk.sys amd_xata.sys storport.sys hal.dll amd_sata.sys 
19:17:21.465    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004974790]
19:17:21.481    3 CLASSPNP.SYS[fffff880019c943f] -> nt!IofCallDriver -> [0xfffffa80039f7040]
19:17:21.481    5 amd_xata.sys[fffff880010cc7a8] -> nt!IofCallDriver -> \Device\0000005b[0xfffffa800489e9c0]
19:17:23.587    AVAST engine scan C:\Windows
19:17:34.055    AVAST engine scan C:\Windows\system32
19:21:17.119    AVAST engine scan C:\Windows\system32\drivers
19:21:31.659    AVAST engine scan C:\Users\admin
19:22:01.626    AVAST engine scan C:\ProgramData
19:23:05.446    Scan finished successfully
19:39:00.604    Disk 0 MBR has been saved successfully to "C:\Users\admin\Desktop\MBR.dat"
19:39:00.620    The log file has been saved successfully to "C:\Users\admin\Desktop\aswMBR.txt"


aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-05-16 19:05:46
-----------------------------
19:05:46.884    OS Version: Windows x64 6.1.7601 Service Pack 1
19:05:46.884    Number of processors: 4 586 0x503
19:05:46.884    ComputerName: STAND-PC  UserName: admin
19:05:49.520    Initialize success
19:05:54.684    AVAST engine defs: 12051500
19:06:06.976    The log file has been saved successfully to "C:\Users\admin\Desktop\aswMBR.txt"


aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-05-17 08:57:58
-----------------------------
08:57:58.449    OS Version: Windows x64 6.1.7601 Service Pack 1
08:57:58.449    Number of processors: 4 586 0x503
08:57:58.449    ComputerName: STAND-PC  UserName: admin
08:58:00.446    Initialize success
08:59:39.491    AVAST engine defs: 12051601
09:00:09.006    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000005b
09:00:09.006    Disk 0 Vendor: ST315005 CC34 Size: 1430799MB BusType: 11
09:00:09.022    Disk 0 MBR read successfully
09:00:09.022    Disk 0 MBR scan
09:00:09.037    Disk 0 Windows 7 default MBR code
09:00:09.053    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048
09:00:09.069    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS      1398953 MB offset 206848
09:00:09.100    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS        30720 MB offset 2865262592
09:00:09.131    Disk 0 Partition 4 00     12  Compaq diag NTFS         1024 MB offset 2928177152
09:00:09.178    Disk 0 scanning C:\Windows\system32\drivers
09:00:19.942    Service scanning
09:00:40.237    Modules scanning
09:00:40.253    Disk 0 trace - called modules:
09:00:40.284    ntoskrnl.exe CLASSPNP.SYS disk.sys amd_xata.sys storport.sys hal.dll amd_sata.sys 
09:00:40.284    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80046bd790]
09:00:40.284    3 CLASSPNP.SYS[fffff88001bbc43f] -> nt!IofCallDriver -> [0xfffffa80039f7040]
09:00:40.300    5 amd_xata.sys[fffff880010b77a8] -> nt!IofCallDriver -> \Device\0000005b[0xfffffa80044ac9c0]
09:00:42.687    AVAST engine scan C:\Windows
09:00:45.947    AVAST engine scan C:\Windows\system32
09:04:19.293    AVAST engine scan C:\Windows\system32\drivers
09:04:46.796    AVAST engine scan C:\Users\admin
09:05:11.428    AVAST engine scan C:\ProgramData
09:05:55.920    Scan finished successfully
09:57:00.561    Disk 0 MBR has been saved successfully to "C:\Users\admin\Desktop\MBR.dat"
09:57:00.576    The log file has been saved successfully to "C:\Users\admin\Desktop\aswMBR.txt"
         

09:00:09.037 Disk 0 Windows 7 default MBR code

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Malwarebytes meldet 1 Fund ... ich habe nichts bereinigen lassen!

Hier das Log:

Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.05.17.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
admin :: STAND-PC [Administrator]

17.05.2012 21:52:33
mbam-log-2012-05-17 (23-03-52).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 423041
Laufzeit: 41 Minute(n), 7 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Windows\winsxs\amd64_microsoft-windows-d..ostic-user-resolver_31bf3856ad364e35_6.1.7600.16385_none_2129f6bd1f6002ae\DFDWiz.exe (Trojan.FakeAlert) -> Keine Aktion durchgeführt.

(Ende)
         

Und AntiSpyware meldet auch 1 Fund ... auch da habe ich nichts bereinigen lassen!

Das Log:

SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 05/19/2012 at 07:44 PM

Application Version : 5.0.1148

Core Rules Database Version : 8623
Trace Rules Database Version: 6435

Scan type       : Complete Scan
Total Scan Time : 01:07:05

Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Administrator

Memory items scanned      : 813
Memory threats detected   : 0
Registry items scanned    : 66702
Registry threats detected : 0
File items scanned        : 131336
File threats detected     : 1

Trojan.Agent/Gen-Yoddos
	C:\PROGRAM FILES\WINRAR\DEFAULT.SFX
         

C:\Windows\winsxs\amd64_microsoft-windows-d..ostic-user-resolver_31bf3856ad364e35_6.1.7600.16385_none_2129f6bd1f6002ae\DFDWiz.exe (Trojan.FakeAlert

Bin mir nicht sicher ob das nicht doch ein Fehlalarm ist. Der von SUPERAntiSpyware ist aber auf jeden Fall ein Fehlalarm.
Werte die von Malwarebytes gefundene Datei bitte mal hier aus => http://www.virustotal.com und poste die Ergebnisse bzw. am besten den Ergebnislink

Hier der Link:

https://www.virustotal.com/file/42761cbb8d72595c61fb6e52699fe3fb609509582b7055490ffb8fd31d09c996/analysis/

Scheint ein Fehlalarm zu sein!

Werte die Datei bitte aus für den Fall der Fälle, also eine neue Auswertung bei VT starten

Ähh das hatte ich ja gemacht und dir eben den Link gepostet ...

Hier nochmal der Link vom reScan:

https://www.virustotal.com/file/42761cbb8d72595c61fb6e52699fe3fb609509582b7055490ffb8fd31d09c996/analysis/1337635343/


Und hier ein Versuch einer Hardcopy:

SHA256:

42761cbb8d72595c61fb6e52699fe3fb609509582b7055490ffb8fd31d09c996



SHA1:

1d090f4c9c7234aeaf52e13cdec075164ff3d0fa



MD5:

4a3bd2bb1b55c39ab71ef4c9b9dce815



File size:

77.5 KB ( 79360 bytes ) 



File name:

C:\Windows\winsxs\amd64_microsoft-windows-d..ostic-user-resolver_31bf3856ad364e35_6.1.7600.16385_none_2129f6bd1f6002ae\DFDWiz.exe



File type:

unknown



Detection ratio:

0 / 42



Analysis date:

 2012-05-21 21:22:23 UTC ( 0 Minuten ago ) 







1



0

 
More details





Antivirus

Result

Update




AhnLab-V3

-

20120521



AntiVir

-

20120521



Antiy-AVL

-

20120521



Avast

-

20120521



AVG

-

20120521



BitDefender

-

20120521



ByteHero

-

20120521



CAT-QuickHeal

-

20120521



ClamAV

-

20120521



Commtouch

-

20120521



Comodo

-

20120521



DrWeb

-

20120521



Emsisoft

-

20120521



eSafe

-

20120520



F-Prot

-

20120521



F-Secure

-

20120521



Fortinet

-

20120521



GData

-

20120521



Ikarus

-

20120521



Jiangmin

-

20120521



K7AntiVirus

-

20120521



Kaspersky

-

20120521



McAfee

-

20120521



McAfee-GW-Edition

-

20120521



Microsoft

-

20120521



NOD32

-

20120521



Norman

-

20120520



nProtect

-

20120521



Panda

-

20120521



PCTools

-

20120521



Rising

-

20120521



Sophos

-

20120521



SUPERAntiSpyware

-

20120519



Symantec

-

20120521



TheHacker

-

20120521



TotalDefense

-

20120521



TrendMicro

-

20120521



TrendMicro-HouseCall

-

20120521



VBA32

-

20120521



VIPRE

-

20120521



ViRobot

-

20120521



VirusBuster

-

20120521

 Comments
Votes
Additional information








































 












































ssdeep
 1536:4/vdl2M92lfJUD4JOSE0effXxT830AQIR+kd73MlX:4v3282laKE0ae30ArAkdA 



TrID
 Win64 Executable Generic (95.5%)
 Generic Win/DOS Executable (2.2%)
 DOS Executable Generic (2.2%)
 Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
 



ExifTool
UninitializedDataSize....: 0
InitializedDataSize......: 11776
ImageVersion.............: 6.1
ProductName..............: Microsoft   Windows   Operating System
FileVersionNumber........: 6.1.7600.16385
LanguageCode.............: English (U.S.)
FileFlagsMask............: 0x003f
FileDescription..........: Windows Disk Diagnostic User Resolver
CharacterSet.............: Unicode
LinkerVersion............: 9.0
FileOS...................: Windows NT 32-bit
MIMEType.................: application/octet-stream
Subsystem................: Windows GUI
FileVersion..............: 6.1.7600.16385 (win7_rtm.090713-1255)
TimeStamp................: 2009:07:14 01:32:01+02:00
FileType.................: Win64 EXE
PEType...................: PE32+
InternalName.............: DFDWiz.exe
ProductVersion...........: 6.1.7600.16385
SubsystemVersion.........: 6.1
OSVersion................: 6.1
OriginalFilename.........: DFDWiz.exe
LegalCopyright...........: Microsoft Corporation. All rights reserved.
MachineType..............: AMD AMD64
CompanyName..............: Microsoft Corporation
CodeSize.................: 68096
FileSubtype..............: 0
ProductVersionNumber.....: 6.1.7600.16385
EntryPoint...............: 0xf2e4
ObjectFileType...........: Executable application
 



Sigcheck
publisher................: Microsoft Corporation
product..................: Microsoft_ Windows_ Operating System
internal name............: DFDWiz.exe
copyright................: (c) Microsoft Corporation. All rights reserved.
original name............: DFDWiz.exe
signing date.............: 9:32 PM 11/20/2010
signers..................: Microsoft Windows
               Microsoft Windows Verification PCA
               Microsoft Root Certificate Authority
file version.............: 6.1.7600.16385 (win7_rtm.090713-1255)
description..............: Windows Disk Diagnostic User Resolver
 



Portable Executable structural information
Compilation timedatestamp.....: 2009-07-13 23:32:01
Target machine................: 0x8664 (x64)
Entry point address...........: 0x0000F2E4

PE Sections...................:

Name        Virtual Address  Virtual Size  Raw Size  Entropy  MD5
.text                  4096         67796     68096     6.27  1c7bdc5775f28516be193bb83c55bf95
.data                 73728          2008       512     0.61  6a0660ec5c968bdadafbea098622807c
.pdata                77824          1812      2048     4.25  30a0d6187e44f1b2d96f60b56cc400a7
.rsrc                 81920          7152      7168     4.30  0fa6204cdaf076caeb1a2a64940f55a2
.reloc                90112           240       512     0.54  e2989db22741117fddf9674837b35511

PE Imports....................:

GDI32.dll
	SelectObject, DeleteObject, AbortDoc, EndDoc, EndPage, StartPage, StartDocW, CreateFontIndirectW, GetDeviceCaps, SetMapMode, SetAbortProc, DeleteDC

KERNEL32.dll
	GetCurrentThreadId, GlobalFree, MulDiv, HeapAlloc, GetCurrentProcess, CreateFileW, WriteFile, HeapFree, OpenMutexW, CreateMutexW, GetProcAddress, GetVersionExW, FormatMessageW, GetProcessHeap, HeapSetInformation, RegisterApplicationRestart, GetSystemTime, SystemTimeToFileTime, CloseHandle, CreateEventW, OutputDebugStringA, QueryActCtxW, GetModuleHandleExW, SetLastError, GetModuleFileNameW, CreateActCtxW, FindActCtxSectionStringW, LoadLibraryW, ActivateActCtx, GetLastError, LocalFree, Sleep, GetStartupInfoW, SetUnhandledExceptionFilter, GetModuleHandleW, QueryPerformanceCounter, DeactivateActCtx, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, UnhandledExceptionFilter, DeviceIoControl, FindFirstVolumeW, FindNextVolumeW, FindVolumeClose, GetVolumePathNamesForVolumeNameW

msvcrt.dll
	memset, memcmp, wcsstr, _wcsupr, __CxxFrameHandler3, __2@YAPEAX_K@Z, _vsnwprintf, __3@YAXPEAX@Z, __getmainargs, __C_specific_handler, _wcslwr, _amsg_exit, _XcptFilter, _terminate@@YAXXZ, __set_app_type, _fmode, _commode, __setusermatherr, memcpy, _initterm, _acmdln, exit, _cexit, _wcsicmp, _ismbblead, _exit

OLEAUT32.dll
	-, -, -, -

ADVAPI32.dll
	TraceMessage, OpenProcessToken, RegOpenKeyExW, EventWrite, RegQueryInfoKeyW, RegCloseKey, RegEnumKeyExW, RegDeleteKeyW, ConvertStringSecurityDescriptorToSecurityDescriptorW, LookupPrivilegeValueW, AdjustTokenPrivileges, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, InitiateShutdownW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, GetTraceLoggerHandle, GetTraceEnableLevel, GetTraceEnableFlags, RegisterTraceGuidsW, UnregisterTraceGuids, EventRegister, EventUnregister, RegEnumValueW

ntdll.dll
	RtlVirtualUnwind, RtlCaptureContext, RtlLookupFunctionEntry, WinSqmStartSession, WinSqmEndSession, WinSqmAddToStream, WinSqmSetDWORD, NtQuerySystemTime

ole32.dll
	CoCreateGuid, CoInitializeEx, StringFromGUID2, CoInitialize, CoCreateInstance, CoUninitialize

SETUPAPI.dll
	SetupDiGetDeviceInterfaceDetailW, SetupDiEnumDeviceInterfaces, SetupDiDestroyDeviceInfoList, SetupDiGetDeviceRegistryPropertyW, SetupDiGetClassDevsW

USER32.dll
	SetDlgItemTextW, DialogBoxParamW, LoadStringW, MessageBoxW, SetFocus, TranslateMessage, IsDialogMessageW, DrawTextW, ShowWindow, CreateDialogParamW, EnableWindow, SetCursor, EndDialog, GetDlgItem, PostMessageW, GetParent, DefWindowProcW, EnumThreadWindows, SetWindowPos, SendMessageW, LoadIconW, DestroyWindow, MsgWaitForMultipleObjects, PeekMessageW, SetWindowLongPtrW, GetWindowLongPtrW, CreateWindowExW, LoadCursorW, DispatchMessageW

USERENV.dll
	GetUserProfileDirectoryW


PE Exports....................: 



Symantec Reputation
Suspicious.Insight 



First seen by VirusTotal
 2010-01-26 12:51:28 UTC ( 2 Jahre, 3 Monate ago ) 



Last seen by VirusTotal
 2012-05-21 21:22:23 UTC ( 1 Minute ago ) 



File names (max. 25)
1. file-3945503_exe 
2. DFDWiz.exe 
3. smona130911664940069802407 
4. smona130911651608768022116 
5. C:\Windows\winsxs\amd64_microsoft-windows-d..ostic-user-resolver_31bf3856ad364e35_6.1.7600.16385_none_2129f6bd1f6002ae\DFDWiz.exe 
6. tmp\DFDWiz.exe 
7. 1d090f4c9c7234aeaf52e13cdec075164ff3d0fa 
8. dfdwiz.exe 



Blog | Twitter | contact@virustotal.com | Google groups | TOS & Privacy Policy
         

Ja das ist ein Fehlalarm


Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

OK, dann mal ein grosses DANKE für deine Hilfe!!! System läuft, mir wär sonst nichts aufgefallen.

MVPS werd ich mir ansehen!

Ich muss leider den Internet Explorer verwenden, da meine Kids auch surfen und ich den Family Safety Filter sehr gut finde. Hatte früher auch lieber den Firefox, nur habe ich dort nichts gefunden womit ich meine Kids "schützen" kann.

Jedenfalls werde ich beim Browser schliessen immer alles löschen lassen.

Als Virenschutz nutze ich AVIRA ... taugt der was? Firewall hab ich blos die von Windows aktiviert. Gibts da von dir Tipps oder Programme? Gratis sollten sie halt schon sein ...

lg, Mike